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Lssue 1 



1 he L*ammei has objected to the specification a c failing to piowde propei antecedent basis fui 
the damied subject matte; 

The ! vanillic has aigued that Itjhe claim limitations legauhng identifying whet hot <0 hO and 
(in) ui combination is not suppotted In {he specification \ppellant t espeu fu!h disagiees and 
points our that page 0 hues 12-M ot the specification sta^ that "the anti-\ n us mechanism ^ can 
a pp l x the techniques dcsuihcd hototnaftci to tesist mas-, mailing maluate ' and also notes that 
page <■> lines 21-22 ol the specification states that "the geneial purpose computet 200 opetaung 
undei umtin] of a suitable computet piogram ma\ peifoim the above desuibed teihmqtks ' 
(emphasis added} Tor these and othet teasoiio snppott tot the combination of <i) in) and {m) 
claimed m each of the independent claims ts piesent Of eotft*>e such citations aic set forth b\ 
was ni example otib and .should not be cuitstiued limiting to the e!anns in am mannei 

In the h\ammer s Kuswet mailed 10 0^ 20CH, the fcvitnmer has argued that "appellants ha\e 
oni\ pointed at die geneial statements tn she specification" and that "[njcithei ol the so 
statements explicit!) oi implicit!) pioudes support foi identsfvsug aii of (t) in) and (sit) 
together ' ! he Lvnmnei has furtUct aigued that 1 the .section ol the specification which snppotts 
fi} ui) and (in) located at Page 7 Line H> - Paac 8 I me 1^ onh suppoits idviHifieatunioftht.se 
conditions in the alternative." 

Appel lant respectfully disagrees. A s shown in item .14 of Figure 3 of appellant's specification, it 
I? detes mined w hethet a pacentag e of the total address book addiesj.es who ate Ivmu addtessed 
bv the new e-mail message" exceeds a thicdtold < ->ee also page 6 line 2" - pige ~, line 1 ol the 
spec t Ik at ton - emphasis added) A.s furthet shown item 28 of Figuie > discloses that the email 
message is added to a quarantine queue % {see also page 7 lines 2^-2^ of the specification) 

Moieoxei, with aspect to the description of bieua 4 of appellant s specification, page n lines 
>1-M teach that 'lajt step 30 the system waits 1 1 iccene an e-mail message issued *u>ni step 2S 
ot Ftguie 3 ' and that '[wjhen an e-mad message is tecened step ^2 senes to eompaie the 
received e-mail message with am easting message.* cut rent! v held withm the quarantine queue' 



temphasss added} Page 8, lines 1-3 of the opecffieatiou spectfioaiK states that such companion 
ma\ 'idemiljvl the same an> messages dialing above a piedetotmtned threshold level of 
content" (emphasis added). 

Thus foi at least the ieasoiu noted abuxc appellant's specification, as ostgmaiK filed eieaih 
suppoits the combination of u) hi) and On) claimed m eaeh of the independent claims \gam 
it should be noted that such citations aie set ftith b\ \va\ of example onlv and should not be 
const! ued limiting to the claims in an\ mannet 

.Issue # 2: 

fhc I \armnet has rejected Claims 1-i o-12 H-20 and 22-2^ undei 3^ I Sf 112, firsi 
paiagiaph as fading to eompK vv uh the written desenption lequtiement 

iitoup ' I Cfd'iH* M o-12 14-20 anJ22-2l t 

fhc jrxummct ha< allied that "theie is support foi each of (0 in) and (m) sn the alternative, as 
shown m page " line >0 ~ page h hue 15 of the piesent specification but nevei as a 
combination " Appellant tespeeuoih dtsagtees and points out that page o lines 12-H of the 
specification states that 'the ami-\sius mechanism o can apply the techniques descitbed 
heiemaftci to resist ma^s ma ding malwaie, ~ and also note> that page 1J lines 21-22 of the 
specification states that the geueial putpuse computet 200 opeuumg imdei control of a suitable 
computer pio^iam mas peifoim the above descnhed teihnu|ues " {emphasis added* Ihtis 
support foi the combination of (i) (u), and (m} claimed in each of the independent claims is 
present Of coutse Mich citation^ aie set fotth b\ wav of example onU and should not be 
const! ued limning to the claims in an\ mannei 

In the 1 xammei s Answei mailed 10 0^ 200" the Pxammei h<ts aigued that "appellants have 
onlv pointed at the genetal .statements m the specification, and that "frfjeithei of these 
^tatcmenb expltcifh oi smpltcstk pioMdcs suppon tot identifying all o{ h) <uk and (hi) 
together " T he f xammti has futlhei aigued that the section of the specification which supports 
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<n 00 and (us), located at Page 7 Line <0 - Page 8 Line IS. only supports identification of these 
conditions hi the alieniatise 



Appellant respectfully disagrees. As shown in item 14 of Figure 3 of appellant's specification, it 
ii> detci mined whether a pcucnlage of the total addiess book addiesses v\ ho aie being addicted 
bx the new e-mail message" exceeds a thm>hold {see a ho page 6 hue 2" - page ~ line 1 oi the 
specification - emphasis added) V; furthet shown, item 2^ of Hguie ? discloses that 'the email 
messaae it. added to a quarantine queue ' {see also paae 7 . lines 2 }-2^ of the specification) 

Moieoxei with respect to the desuipuon of! sgwe 4 oi appellant <■ specification page ~ hues 
> 1 -34 teach that ' |ajt step 30 thi s>steiu wans to recene an e-mail message issued fiom step 2b 
of I iguie 3 1 and that ^wjhut an e-mail mcs-agc is leceixed, step ^2 sei\e i to compaic the 
lecened e-nuil menage wuh an\ existing messages umentix held within the quaianmu 1 queue 
t emphasis raided) Page 5< lines 1-3 uf the specification .-peufiealh Mates that such eompanson 
max ulentsfjx | as the same am messages shating ahou a pudaeimtiKd threshold le\ei oi 
content " (emphasis added). 

Thus, for at least the reasons noted above, appellant's specification, as originally filed, clearly 
supports the combination of ft), 00- and {iii) claimed in each of the independent claims. Again, 
it should be noted that such citations are set forth by way of example only and should not be 
construed limiting to the claims in any manner. 

'issue #3: 

The Fxammei has icjeued Claims I A 7 <M I 15, I7-1<\ 2\ and 26 imdci 35 \ ' S C iO^a) as 
being unpatentable iwei Bates u al (T b Patent No 'w^o^i ; tn steu 0 f Maish (T S Patent 

No. 6,763,462). 

Group #/: Claims 1-3, 7,9-11, 15, 17-19, and 23 

In order to establish a prima facie case of obviousness, three basic criteria must be met. First 
there must he some suggestion or motivation, either in the references themselves or in the 
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knowledge generally available to one of ordinary skill in the an, to modify the reference or to 
combine reference teachings. Second, there must be a reasonable expectation of success. 
Finally, the prior art reference (or references when combined) must teach or suggest all the claim 
limitations. The teaching or suggestion to make the claimed combination and the reasonable 
expectation of success must both be found in the prior art and not based on appellant's 
disclosure, in re fWrA-,947 F.2d 488. 20 USPQ2d 1438 (Fed.Cir. 1991). 

With respect to the third element of the prima fuck' case of obviousness, and particularly with 
respect to the independent claims, the Examiner has relied on Col. 9, lines 3-19 front the Bates 
reference to make a prior art showing of appellant's claimed "comparison logic operable to 
compare said e-maii message with at least one of an address book of a sender of said e-mail 
message and one or more previously generated e-mail messages from said client computer" (see 
this or similar, but not necessarily identical language in the independent claims). 



Appellant respectfully notes that the excerpt from Bates relied on by the Examiner simply 
teaches 'comparing the new e-mail source address with the source addresses of e-mail received 
during a designated "B"' time period' (emphasis added). Clearly, in Bates, a new e-mail source 
address is only compared with e-maii received , which does not meet ^comparfing] sakl e-mail 
message with at least one of an address book of a sender of said e-mail message and one or more 
previously generated e-mail messages from said client computer " where "said previously 
generated e-mail messages [are held] in a quarantine queue for at least a predetermined 
quarantine period prior to being sent from said client computer .," in the context specifically 
claimed by appellant (emphasis added). 



in ihe Examiner's Answer mailed i0/05''2007 5 the Examiner has argued that. "'.Bates disclosed in 
Col. 6, Lines 64-67 that as 'an additional feature, prediction application 42 may also analyze 
out-going e-mail in the same manner as in-coming e-mail to predict the likelihood of each 
outgo 'mg e-mail as spam."" Specifically, the Examiner has argued thai "in Bates, when 
analyzing an e-mail which is out-going., it is clear thai the e-mail received' by the prediction 
application 42 would have been generated in the client, and therefore the new email 'source 
address', which is part of the new e-mail is compared with the received' out-going mail'' Also 
in the Examiner's Answer mailed 10/05/2007, the Examiner has argued that "Marsh clearly 
teaches comparing an e-mail message with an address book of a sender of said e-mail message, 
as seen in the Background of Marsh and Col 2, Line 34 - Col. 3 Line 65/' Further, the Examiner 
has argued that "Bates, in Col 9 Lines 3-5, disclosed comparing new e-mail with the source 
addresses of e-mail received during a designated "B s time period." and that such "'list' of source 
addresses falls within the scope of an address book " Appellant respectfully disagrees. 

Additionally, with respect to the independent claims, the Examiner has relied on Col °, line 64 ••• 
Col 10, line 10 from the Bates reference to make a prior art showing of appellant's claimed 
■'identifying logic operable to identify whether... said e-mail message contains message content 
having at least a threshold level of similarity to non-identical message content of said previously 
generated e-mail messages being sent to more than a threshold number of addressees specified, 
within said address book" (see this or similar, but not necessarily identical language in the 
independent claims). 




Appellant respectfully asserts the excerpt from Bates relied on by the Examiner merely discloses 
"comparing the content of e-mails that are the same size as the new e-mail with the content of the 



-6~ 



new e-mail' {emphasis added). However, appellant claims a technique where "said e-mail 
message contains message content having at least a threshold level of similarity to non-identical 
message content, of said previously generated e-mail messages being sent to more than a 
threshold number of addressees specified within said address book ,'' in the context claimed 
(emphasis added). Appellant notes that simply nowhere in Bates is there any disclosure of "e- 
mail messages being sent to more than a threshold number of addressees specified within said 
address book /" in the context claimed by appellant (emphasis added). 

Additionally, appellant respectfully points out block 98 in Fig. 4A of the Bates reference, which 
'depicts a determination as to whether or not the number of users receiving e-mail from the same 
source address during the <; B" time period is greater than a designated : "C" number of recipients' 
(Col. 9, lines 9-12). In Fig. 4A, if the determination in block 98 results in an affirmative, or 
""YES," result, the process skips block 1 14 . which "depicts a determination as to whether or not 
substantial similarities in content are found between the new e-mail and. a particular amount of 
same sized e-mail'" (Col. 10, lines 1-4), and instead proceeds directly to block 120,. which 
'illustrates marking the new e-mail as predicted spam" (Col. 10, lines 17-18). Clearly, this fails 
to meet, and even teaches away from appellant's claimed, "identifying logic operable to identify 
whether .. .said e-mail message contains message content having at least a threshold level of 
similarity to non-identical message content of said previously generated e-mail messages being 
sent to more than a threshold number of addressees specified within said address book/' as 
claimed (emphasis added). 

In the Examiner's Answer mailed .10/05/2007, the Examiner has argued that "Bates discloses 
determining whethet ot not the number of users reeerung e-mail from the same soutce address 
during a time pet tod is gteatct than a designatee numbei of recipient as is seen in Col 9 Lmes 
-M'> " Ihe r m net has ahu digued that 1 [bjecatFe the ^ouice uddte^ rs a poiuon .>f an e- 
matl message as l> the leapiem addiess, and because the messages being 'tallied" all have the 
same so nice address, then these tallied messages have at least that !e\el of similant\ vuth one 
another xuthout being identical " still vet. the fcx.amim.-i has atgued that "because the list of 
itseis who ha\e icceived e-mail liom the same souice addicsa dtttmg the 'B" ume pet tod 
constitutes an addiess book Bates has disclosed tins particular limitation ' 
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Appellant lespcctfuib disagrees A.n addiess book x% htoh includes a its* 01 i^eis *ho haw 
tecened e-mail from the same source addies* as noted b\ the 1 vunmer fads to meet 
appellant's claimed 'piewousls geuaated e-mail messages being sent to muse {ban a tmeshold 
numbt't of addjossees specified wuhm said addiess book, as claimed {emphasis added) In 
addition Bates onl\ discloses "soukcs addiesses of e-mail icceixed dming a designated R time 
peuod' (Col L -> hues 4-->) which cleail) does not even suggest am sou of threshold, lei alone 
speuficalls meet appellant s claimed 'piewousls generated e-mail messages being sent to moie 
than a threshold number of addiessees specified \Mthin said addiess hook ' as claimed 
(emphasis added). 

Also in the Examiner's Answer mailed 10/05/2007, the Examiner has argued that "Marsh 
teaches, m Col i Lines ^-S"? and ( ol 2 1 me M - ( ol M me ^1 a method foi identiiung \u\il 
spam which itnoKes determining whether a message is addiesscd to mote than }a| cettam 
number of addresses bom the semlets address book, which is mdieame oi a a mis attempting to 
lepheaU itself through e-mail propagation, and that 'jojne of ordinal \ shl! in the ait would 
recognize that In utilizing the teachings of Ma sb m the spam detection s\stem ol Bates, h\ 
dctei mining whether a threshold numbei of addressed from the scudcis addiess hook aie 
included as jecipients oi an e-mail message that the message can be predicted as \ nai spam ' 

\ppciianr lespetttulK disagiees and asserts that the exceipts fumi Niaish uhed on b\ the 
Examine! merel> disclose \truscs that spicad bv sending electiomc mail" {Col L line M k that 
'potential \uu^ acttvit\ nun be detected b\ finding a specified tmmbct of the e-mail addresses 
cone spending to the generated random numbers m the recipients list of ait outgoing message 
and onh that a 1 user ma> be notified ot possible \ mis utmits * (Col \ lines 24- emphasis 
added) Snnpiv now, heie m the exeeipto from \iatsh i cited on In the Fxannnet is theie am 
disclosuie of' pieuousis genuatcd e-mail messages being sent to moie than a tlncshold number 
oi addies^ee-^ specified within said addiess book' which aie utilized m order to * ideutifA 
v\ hethei said e-mail message contains messaec content fkmng at lea>t a threshold le\el of 
similaitt\ to non-identical message content ot st id previously genenttcd e-mail messages,' as 
claimed (emphasis added) HeaiK ftndirg a specified nnmbei ot c-mat! addiesses 
coi responding to geneiated random number in the recipient-, hsi of an outgonm message as in 
Maish, simp! s fails to suggest 'pies rousts generated e-mail message;- being sent to moie than a 
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ti)I^!KM..m»J^ specified wstbm said address book" as churned {emphasis 

added). 



Further, appellant respectfully points out that Bates only discloses that "multiple e-mails are 
iccened at a netwoik server,' and that the "e~mads die anahzed to deteimme patterns til 
sumlant} ' {< ol ^ lilies s^"''* Oieath onK dcteimmmg v\ bethel am sccencd e-rnails are 
sioulai, as in Bates fails to speestkaik teach " pie\ iousjv »enetated e-mail messages being sent 
to mote than a threshold nutnbes of addressees specified within said addict book that are 
utilized to 1 sdeuttlv whefhei said e-mail message comams message content hauug at least a 
thieshuid le\ei ot simdai u\ to non-idenucal message content of\<nd ptev t<">usi\ genetated e-mail 
messag es ' as claimed (emphasis added) 

Still vet in the Examiner s Answet mailed 10 0^ 200", the fxaminei 1ku> aigucd that 
[i IfL'aulmL' appellant's [alxnej amnnem rlw( in the ss^tem of Bates when ^tep s>4 oi Fig 4\ 
ie^uU^ in a 'VI S foi step '»<<. that step 1 14 of Bates, which compaies for substantial smnhumea 
between e-mails, is not executed, and theiefoa Bates does not teach, but rafhet teacheo awa\ 
from, peifoiming both step l >h and 114 the IF jxatmner dtsagteeo " Specific dh the Fsumiuei 
has digued that "as shown m 1 ig 4\ as long as the deteuntnatioiL-> fr«m step - step 110 
continue to le^ult in "NO the deteimmauons ( nc made ' and that appellant's "example when 
step °8 icsiiits in M> is meieb one [of] (Ik scenarios disclosed 1>\ bates t) ml not the 
scenario beiiia lehed upon in rejecting the claims ' ! he hxammei has fuithet aigued that "m no 
wa\ does tin.-, one scenano teach auav bom the scenano ^ hen both step C )N and ,-aep 1 14 aie 
peiloimed " and that ioi am message which does not iia\e tecspients on the inclusion hst but 
ss determined to be notmal (.-mail, and not spam, steps ^ ,md 1 14 aie peifotmed ' 

Appellant respectfulK dssagsees F'igute iA m Rates shows tn block 11 4 dcteimmmg whether 
oi not substantial snmhuiUes in content are found between (he new e-mail and a patttcithit 
amount of same si/ul e-mad (Col 10 lines 1-4} onK if u is deteimined m bluck that (he 
number of nseis recemnti e-mad from die sane somce addsess dumm the " B ' time pet tod is 
NOT gieafei than a designated numbei oi tecipients (lot *) lines 9-12} \ppeliant 
lespLctiullv as^eits that Bates sitnpK does not disclose am scenario othet than detetnunmg 
whether substantial sirmlanties ate found between a new e-mail and a paittcuLu amount of same 
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ii/cd e-mati {block 1 14} jf it ts determined thai die mnnbet of usets tecetung e-mail fjont the 
sjme source addtess dming the B* time penod 1* not grcalet than a designated C ' number of 
recipients Hut 1 ? Bates cleat I \ docs not mee*, and actualK aa/i //(.'•> tmm ftom appellants 
claimed Identify ing logic opetable to tdemifv k hcthei said e-mail message contains message 
content tuning at least a threshold lev el ot smulai its to non-identical message content of said 
pie\!ousU generated e-mail message- being <-cnt to more than a tlueshold number oi addressees 
specified within said address book,'" as claimed {emphasis added). 

To this end, appellant respectfully asserts that the Marsh and Bates references, as relied on by the 
Examiner, do not teach or suggest alone or in combination appellant's specific claim language. 
Thus, the third element of the prima facie case of obviousness has not been met, for at least the 
reasons noted above. 

With respect to the first, element of the prima facie case of obviousness and, in particular, the 
obviousness of combining the aforementioned references, the Examiner has argued that it would 
have been obvious to combine Bates with Marsh because "the ordinary person skilled in the art 
would have been motivated to provide means of detecting viral spam as suggested by Marsh, as 
well as giving the user the final say in what is to be done with detected viral spam. ..[and that] m 
this combination it would be obvious that the messages would be held in a "quarantine" for a 
predetermined amount of time prior to sending in order for the user to have the option of deleting 
the messages detected as being viral spam without sending the messages.'' To the contrary, 
appellant, respectfully asserts that it would not have been obvious to combine the teachings of the 
Bates and Marsh references, especially in view of the vast evidence to the contrary. 

For example, the Bates reference teaches that "[ijn accordance with the present invention, 
multiple e-mails are received at a network server intended for multiple clients served by the 
network server" (see Abstract) and that ; [bjlock °2 depicts a determination as to whether or 1C 
not the number of recipients of the new e-mail is greater that a designated "A"" number of 
recipients... [where] a rule designating the "A" number of recipients ts preferably included in 
spam filtering rules for the server" (see Bates Col. 8, lines 56-60). On the other hand, the Marsh 
reference teaches that "the virus detection utility 104 may be an add in program organized into a 
conventional format such as a plug-in for the e-mail application 1 02"' where "[f for example, the 
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Uiits detection ulihls S04 [isj stotcd as a dxuamtc link hbtan ( Pi 1 i file and meiude[s) 
louttnes to execute id conjunction with the e-mail application 102 to petfonu spec i tie 
operations" tsee Matsh Col 2 lines 2o>'>) 

( leaih m Marsh the \ dus detection uu!u\ iuns on clients tn conjunction vwth e-mail 
application^ located uii such clients and titih/es client-based mtoTm.it ton (e g addtes*- boots) 
wheseas, in Bates a gen er is used to teeene e-mails sent to clients and to pt edict undesnabje e- 
mads utd!?ini2 rules stotcd on the serser Ihns Matdi death ujcIh-^ t /H</t from Bate? 
Appellant tcspeclluih potnt* out that u improper to combine teieTeni.es \Uietc the TetcjoDt.es 
tuhh <nun from then combination In w (tu^iih 7 l> F 2d 7 ^2 74^ 21^ I'SPQ 7"o 
(Fed. Circ. 1983). 

In the Fsaminei s Answet mailed 10 0^ 2007 the Fsammci has atoned ih.it * stmph became 
\kits!i difdot-ed a piefeited embodiment on a client, while Bates disclosed a prefeued 
embodiment on a senei does not teach a^av hem jhej siiL^ested combination ' 

Appellant tesjvtftulh dtsagtees and again empha-n/o that iti Muisb the urns detection utibn 
urns on clients in cuutuitciion \\ tth e-mail applications located on such clients and utilizes chem- 
hasxd information (e v; addft-ss books) wheteas m Bates a ?trur is med to recede e-mails sent 
to clients and to ptcdict undesitabk e-mails utilizing inlcs stoted on tin, senu liuis Marsh 
does in f ( tct irui\ fiom Bates 

Also m the hvammei s \nsnet mailed 10 05 200" the Kammet has ai^ued that Bates cLaiU 
teaches that a pc can be both a client and a sen e r (See Bates Col 1 Lines 2 1 -2o), that it io known 
tor e-mail softuaie applications on the client to peiform the fiketmg td unsolicited e-mail (See 
Bates Col 2 1 nics 8-11} that the teachings oi Bates can be applied to out-going emad such as 
tho^e that aufotnaticalh liansinu themsehes iiiih/mg client e-mail addtess bools tSee Bates ( ol 
o I me o4 jto j Col " 1 iik (>} and that unsolicited ending of e-mail can iiMKce->saiih utilize data 
stoiage space on servers tSee Bates Col 2 Lmes S-2) i he- Lxammei has concluded that 
'[b]ased on these teachings alone tt is deai that Bates does not teach a\%a\ (torn filteintg e-mail 
at the diem..'" 



Appellant lespetffulh dtsagtees Bateo dtseloses that ' [ i jn mam neruoiks a pnmat\ function 
ot a >eues is receiving e-mail aduiessed to clients and ttansiuutmu e-mail composed leceived 
horn clients fCul i lines 4 l >-5 i ) [hua Bates death i dates to a server on a network vvludi 
tiansmits o-nuU addtessed to chcnts that has btcn icci-sxcd nom clients in fact .appellant 
respeciftilk poinb out figure 2 of Bates iHusttating a network system m accordance v\ith the 
method swem and ptogiam of The present invention ' tOo] 4 lines 21-21 - emphasi*- added) 
whsdi cleat K bhov\s the network server 40 separate ft urn the chent svstems 60 lt -n Ihus Bates 
only disclose^- a server that rccei\es e-mad from clients whidi i> adduced to othet clients and 
that the sctxet tiausmsts the rescued e-mail to sneh addtessee dtems which does tf<uh i/iu/i 
hom Marsh ^ swetn hj which the Mim detection ultlsl\ myis on client-, in eoniimetiuit with e- 
matl applications located on such clients 

Mmemei in the P\aminci s Answer nun led 10 0> 2 00 7 the fXaininei has asgucd thai one oi 
ordinan fkdi ni the ail woidd ha\e recognized ba.->ed upon the^e teachings of Bates, that m otdei 
to unnccessarih utilize data storage spate on seneis that the filteunu of out-going e-mail should 
be performed at the client utilizing the clients e-mail software packages," 

Appellant respectfully disagrees. For example, appellant notes that Bates does disclose that the 
"unsolicited sending a lecenmg of e-mail can unnteessatih utilize data storage space on 
serveiV* (C ot 2, lines 1-2} How eves, tn response to such problem. Bates does not suggest that 
" m otdet to umiecL-,sanK utilize data storage space on server-* the fihuing of out-going e-nwnl 
should be pei formed at the client utilizing the clients e-mail ^oUwate packages " as alleged b\ 
the iXamines Appellant lespeCtinlK asserts that Bates onU teaches that "[ijn view of the 
tbtegome ("including the unnecessary usage of data stoiuiie space on set\et bv unsolicited e- 
inailsj it would be ad\amageous to piov ide a method for automatical i\ anah/mg elecuomc mad 
as it arrives at a net v\ oik oerver ' (Col >, hues >4-><> - emphasis added) Thus, it would not have 
been obvious to pot font) the 'filteting of ont-gomg e-mail at the client utilizing the clients e- 
mail software packages," as argued by the Examiner, 

To this end, appellant respectfully asserts that the first element of the prima facie case of 
obviousness has also not been met, for at least the reasons noted above. 
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Thus, appeila.nl respectfully asserts that at least the fust and third elements of the prima facie 
case of obviousness have not been met, since it would be iiuobvions to combine the references, 
as noted above, and the prior art excerpts, as relied upon by the Examiner, fail to teach or suggest 
all of the claim limitations, as noted above. 

Group M2: Claim 26 

Y\ im respect to dependent C hum 2o the hvanwer ha> lehed on ( o! 1 hue 06 Col 2 {me ~* m 
Bates to make a punt ait shoutng o,' appellant s claimed technique wherein said e-mail message 
is identified .is potentialK containing ntaiwaie uLn said e-niail message and satd preuou^v 
uenen-tted e-mail mes^-mes share a common attachment 



\ppellant lespecttulh a^setts that 'ikh e\ccrpr from Hates onh discloses that ithei desttnetne 
attachments tan edj.il \ be transmitted ruthm a seises upon attu mon of i single cbeut vuthm a 
netvsoik Ckaih ouK mentioning, an attachment a-- m Bales dn t >-> not e\en suggest 
appellant s speuiii claim language nameK that said e-mail message is identified as potentially 
containing xnaiware vvhen said e-mail message and said picwousk guietated e-mail merges 
siiaic d common attachment ' as claimed (emphasis added) 

In the \ xaminu s Vnswa mailed 10 0s 200" the 1 vtmmes has argued thai Bates teacher 
detc i mining whether a uium number of nscts ucenc the same email and if so piedittinsi it 
as ipjw {See Hates Co! 1 f tnes 2 *-2°} 1 he \ rammer has tiuthet aigned that Bales m L o! 2 
1 mt's disclosed that unsolicited mai' ma\ include- desituetue attachments siw.li that h< 
deteummim whethei a ceitain numhei ot useis receive-, the same email Bates also detei mines 
w bethei an\ attachments m the e-mails ate the same 



Appellant i espcctfuih dtsagtees In L ol 7 lines 22- Mi of B.ucs, Bate,-> discloses that 1 dm tug the 
fust iihennu process ptcdienun application 42 looks for an lirusiuj IK Saige number of tiset-, 
receiving the same e-mail trom a particular uset adchess m a u\en tune period ' and that " [ijn 
paiticulai, ptedietion application -52 not onh checks the "lO" list to sec how mam users an e- 
nunl is sent to, but checks to see il a single nsci addict toi domain J is sending m<m\ tadoied 
spam note*, to uidniduals sen iced bv netwotfs sc-nct 40 % < v emphasi^ added) Mich evcerpt ftom 
Bates also discloses that 1 [tjheiefote in a second Gltenng ptocess if a Luge numbet of tailored e- 
maiK are teemed from a single use! address or domain. piedicmm application 42 pteferabK 
compatcs the messages to determine similarities in content ' such that 1 [i]f thete ts a Luge 
percentage o( similant\ m content then piediction application 42 piefciabK marks the.se e-mails 
a? predicted spam t emphasis added"* Iluis, Bates onh discloses detetmimng e-mails to be 
spam tl such e-mails ha\e a iatge peiccntage of simdantA in content which cicarh does not 
specified! h. disclose that 'said e-mari message is identified as potentialh containing malwaie 
when said e-mail message and said pieuoush geneiated e-mail message^ share a common 
attachment as claimed temphasts added) 

Again, appellant lespectfuih asseits that at lea.-t the fitst and thud elements of the ptwa /</<./<* 
ca-,e of ohuousness ha\e not been met, since it would be utu^nnn^ to combine the refetences 
as noted aho\c and the ptiot ait e\ceipts as relied upon b\ the i \ammer, fatl to teach ot suggest 
ad of the claim limitations, as noted abo\e 

Issue 0 4: 

I he Examine! has i ejected Claims 4 6 !2 14, 20, 22, and 2~-28 undei J* I SO^a) as 
being unpatentable o\et Bates et al tl S Patent No 6"7 f >02H in\ tew of \latsh (I S Patent 
\o <\?o> 4(->2), and futthei m\ie\\ ufBausetai (\ S Patent No o 7S5 " >2HBates2) 

titt'up I CuunsJ 6 12, M :o cwJ 22 

Appellant tespecffnlh asseits that such claims a-e not met by the prior art for the reasons argued 
w nh respect to 1 >sue < if oup ~ 1 
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Again appellant lespectfulh a\seits that at lea-t the fust and thnd elements of the pr<Ma /</<./<* 
ca->e o( obuousness ha\e not been met mhlc it would be /w^iw/n to eumbme ihe refeietji.e\ 
<i-5 noted abose and the pjioi att evceipts as iehed upon bv the i-xammet fad to tea<.h 01 suggest 
all of the claim limitations., as noted above. 

Group M2: Claim 27 

With respect to dependent Claim 27. the Examiner has relied on Col. 8, paragraph 1 in Bates2 to 
make a prior art showing of appellant's claimed technique "wherein a message is sent to a 
malware computer program provider to provide a warning of new ma! ware outbreaks when said 
e-mail message is identified as potentially containing malware." 



Appellant respectfully asserts that the excerpt from Bates2 relied upon by the Examiner merely 
discloses that "\ \\f a virus is found . . . the web client is notified of the virus (step 450)" and that 
''the appropriate authorities may be notified of the. virus ,; {emphasis added). I-lowevei; the mere 
disclosure that if a virus is found, the appropriate authorities may be notified of the virus, as in 
Bates2. simply fails to even suggest a technique "wherein a message is sent to a malware 
computer program provider to provide a warning of new malware outbreaks when said e-mail 
message is identified as potentially containing malware," as claimed by appellant {emphasis 
added). Clearly, the mere disclosure of notifying the appropriate authorities of the found virus . 



as in RateO, sunpK fails to suggest " pio\ tciftngj a wautmg oi new malwate outbreaks' m the 
manner as claimed b\ appellant (emphasis added} 

in the t\aminer\ Answer mailed 10 0^ 2007, the fcxanunef has argued that "fwjhen malwaie is 
detected ni a new e-mail as taught b\ Bates ( md Maish because the e-mail is a new e-mail the 
malwaie in the e-mail is a new instance of the inalware, and theieibie is a new maiware 
outbreak \ppellant respectful Iv disagrees 

Again appellant lespectfuih asseits that at lea-t the fnst and thud dements of the pr<tm /</<./<* 
ca->e of ohuousness ha\e not been met since it would be un<^nsn}>\ to combine the refeieni.es 
<i? noted abose and the prior ait evceipts as lehed upon bv the f-xammet, iari to teadi or suggest 
aU of die claim limitations as noted aho\e 

Group 113; Claim 28 

\\ ith aspect to dependent C I aim 2S, the fc\am nu h; j relied on Col K paragraph 1 m Bates2 
(reproduced above} to make a prior art ohowmg oi appellant's claimed technique 'wheicm sa'd 
message to said niaiwate computet ptogiam prouder includes a cop\ ot said e-mail menage 

\ppellant resptcttulK asserts that the excerpt from Bate; 2 relied upon b\ the Lxammer meids 
discloses that 1 f i^f a \ irtis ii> found the web J tent is notified oi the uttts (^tep I^Of and lhai 
'the appropnate authoiuicv max be notified ol the Mtu.- {cmpbasK- added} llowexet the 
ueneial disclosure that li a wrtts is found the appropriate authorities max be notified of the \ irus 
as in Bates2 simpK fade, to e\en suggest a specific technique 'wherein said menage to said 
malwaie computet program provider includes a cop> of said e-marl message ' as claimed In 
appellant {empha->H added i C leas is the mere disclosure of notth mg the apptopi iate atithonues 
ol the found \nu-> as in P>ate->2 snupix fat!-, to suggest that the message to said malwaie 
computer progiam piuxulei includes a cops of said e-mail message ' m the manner as claimed 
by appellant (emphasis added). 

In the Examiner's Answer mailed JO/05/2007, the Examiner has argued thai "the [EJxaminer has 
relied upon what would have been common sense to the ordinary person skilled in the art of 
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inalware detection, in that upon sending a message notifying a virus detection company of 
detection of an e-mail infected by ma i ware _ it would have been common sense to include the 
infected email in the message in order to allow the virus detection company to analyze the virus 
for future detection." 

Appellant tespeetlulh disagiecs Bafes2 uuh geneialb Ji^closcb that ' [ljf a wnts is found the 
appiopi fate authonties ma\ be notified of the v jus ' KVi S hues i 1-1 o - emphasis added! In 
fait appellant note-, that Bates actual Is discloses that " t ff a \mh ^ found the e-mail message 
is deleted and a separate e-mail is sent to the intended teetpient of the e-mail inhuming the 
leeipiuit that the deleted e-mail message contained a \itus and automatically deleted'' (Vol 
<■> lines Thus Baks onlv general U teaches nottfsmy apptopuate atnhonties of a \itua 

and that an e-mail message )- deleted when a situs is found in such e-mail irk <■ sage Mmplv 
nowhere does Bate O e\en suggest that the message to said malvwnc computet piogtam 
juovidei includes a cop> uf said e-niaii message ni the niatmet aa claimed In appellant 
(emphasis added). 

in response to the F \amtnet s appaicnt tehance on Offkiai Notice in lejectmg appellants 
specific claim language, appellant again points out the i emails abo\e that cieaiK show the 
mannei in which some of such claims ituthei distinguish the puot art ielied onb\ the 1 \aminet 
\ppciiant thus for malls requests a specific showine of the subject mattei m \LL of the claims in 
am future action Note exceipt iiom \1PFP below 

If the j appellant tsaserses such an [Official Notice] amnion the examine! should cite a 
reteience m support of his ot her position See MPhF 2 144 OS 

■\gain appellant lespectfutls assetts that at least the fust and thud elements of the /w.hj >jlu 
case uf obsionsuoss ha\e not been met since it would be. utiohious to combine the teletence-, 
as notvd abo\e and tlK pi mi ait exeupts, as tehed upon bs the I \amma. fail 10 teach ui suggesi 
ail ot the claim limitations as noted aboxe 



Issue #5; 



The fxarmnei has t ejected ( lanus is lo and 24 undet 35 ISC HH<a) as being unpatentable 
o\ ei Basu« u\ al tl S Patent No 0 770 021} tn wcw oJ \kusli ll'S Patent No 0,763,462} and 
iurthei in vseu of kou/netsos (L s Patent No f>J25 }~ 7 ) 

(rroup v.!: Claims A. /6. 24 

Appellant lespectfulK asseits that .such claim.} a:e not met b\ the pnot ait Tot the teasons argued 
vv ith lespect to ft>sue *3 Cuonp ~1 

Again appellant lespeahillv asset ts that at least the fust and thud elements ol ihe p* ma fih w 
ease of obwousness Ime not been met sinee n would be tmohv/om to combine the leieienccs 
as noted above, and the pnor ait excerpts as icl^d upon b\ the b\ammei, fail to teach or suggest 
ajl of the elatm limitations as noted above 

Issue # 6; 

The Fxaminet has t ejected C hum 2S undei >S I SO 103(a) as being unpatentable ovei Rates et 
al (IS Patent No o7~ t >,t)21) m \ tew of Mai^h (( ' S Patent No 6"M4o_) and fui liter m 
view of Radam {V s Patent No 6 "t.i 467) 

Group #i; Claim 25 

With respect to dependent Claim 25, the Examiner has relied on Col L lines 36-48 of the 
Radatti reference to make a prior art showing of appellant's claimed technique "wherein said e- 
mail message is identified as potentially containing mahvare only if said e-mail message includes 
an executable element, to speed processing.'' 
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Speubealls appellant not. , thu the bxaminer has aiaued that Radatti teaches that 01A 
executable code mn contain nuiwate " \ppellant tespeeimlis disainecs and points out that the 
except from Radatti motels discloses thai [all btnars exeuitables wife's joss ed shell script-, 
and souue code accessed fiom an external network mas contain worms smise^- ot hoian 
hot^es and that ' outside bmais exeustables »heli senpts and scanned somce code mas i-ntet an 
interna] netuoik ot single lompmer s\ ->tem iiuongh an F mad attachment (emphasis added) 
( ieaih disdoMiu th.it bmais es.ee utahies may contain unnn snuses 01 ! rojau hotse-i as m 
Radatti does not Highest that ' only executable cock max comam maiwaie ' a-, noted b\ the 
1 \ammei (emphans added) 1 tutheimoie, simpK disclosing that executables mas cunta.n 
w turns \nuscs ot liojanhotsc* as ?n Radatti does not spccitiealis teach ans soit of e-mail let 
alone meet appellant s spcctfkalh claimed teJinque ' ssheicm said t-mail message is identified 
as potemialls containing mahsaie oris it -aid e-mail message includes an executable element to 
speed ptocessing ' as claimed h\ appellant (emphasis added) 

In the 1 vtminei s Answet mailed 10 OS 2W the 1 sammer hts atcmcd that [b]eeanse it ssab 
well Ujktoi) thai mahsaie fequues ar executable element and more specitiealK that e-mail 
piopagatcd MHiscs as aic beiny detected in tie totnbin.it ion o{ Batc^ and MaNi iequne an 
executable pas load it vw uid have been ob\ ous to the otdmaix person skilled m the au at the 
time of imennon to base onh idenfiied an e-mail as potentialh conunmni> malsxaie ii it 
contained an executable pas load m urdet to picwit 'ue*at[ion [ot] umieceisats lalse 
positives Ihe i \annnei has a ho aigucd that because ail malssate must hase an executable 
clement it would have been >. bstous to one ot ordmarv okdl m the ait to not identif\ an e-inai. as 
potentialh containing mahsaie it it did not ha\e an executable element 

I iist appellant jespcctkiiix asserts that smipls alleging that maiware lecpntes an executable 
element as noted b\ the fc^ammei does not suppoit the I xammei s obstonsness argument with 
icspcvt to appellaiit ■» claimed technique whetem said e -mad message is identified as potential is 
containing mabsaio onh ii «,aul e-mail message includes an executable element to speed 
ptocessum as claimed t emphasis added) Kppeiiam tc^pectftdh assert^ that smipls because 
ionu' executable elements mas include malwate docs not make it ohs sous to idcntib. an ' e-mail 
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message. . as potentially containing mahvare onty if said e-mail message includes an executable 

ejemeiU," as claimed (emphasis added), in fact, appellant respectfully points out that none of the 
prior art references, as relied on by the Examiner, disclose that an "e-mail message is identified 
as potentially containing mahvare only if said e-mail message includes an executable element, to 
speed processing," as appellant claims (emphasis added). 

Second, appellant respectfully asserts that simply alleging that "because all mahvare must have 
an executable element, it would have been obvious to one of ordinary skill in the art to not 
identify an e-mail as potentially containing mahvare if it did not have an executable element." as 
noted by the Examiner, does not imply the converse. For example, not identifying an e-mail as 
potentially containing mahvare if it did not have an executable element, as noted by the 
Examiner, does not imply that an "e-mail message is identified as potentially containing mahvare 
only if said e-mail message includes an executable element, to speed processing." as appellant 
claims (emphasis added). 

Thus, in response to the Examiner's apparent reliance on Official Notice in rejecting appellant's 
specific claim language, appellant again points out the remarks above that clearly show the 
manner in which some of such claims further distinguish the prior art relied on by the Examiner. 
Appellant thus formally requests a specific showing of the subject matter in ALL of the claims in 
any future action. Note excerpt from MPEP 214103, cited above. 

Again, appellant respectfully asserts that at least the first and third elements of the prima facie 
case of obviousness have not been met, since it would be utiobvioits to combine the references, 
as noted above, and the prior art excerpts, as relied upon by the Examiner, tail to teach or suggest 
ah of the claim limitations, as noted above. 

In view of the remarks set forth hereinabove, all of the independent claims are deemed 
allowable, along with any claims depending therefrom. 
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in the esenr a telephone com ei satum would expedite the ptot-ecutioti oi this application the 
IXumines niav ieach the undersigned at (408) ^7 1 -25"" ^ For pavment of am additional let 1 ? due 
in connection w uh the filmu of thus papei the Commissioner is authou/ed to charge such fees to 
Deposit Account No ^0- 1 3 M (( >rder \o N Al i P4n2) 



Respeufulh submitted 



Bv KF\ i\71Lk\ Date; December 5, 200? 

Resm J /i\ku 
Key No 41 42^ 

/dka-kotak P.O. 

FO Box "2 i 120 

S<tn .lobe, C ahfonna l >5 172-11 20 

Telephone {408} 071-257* 

facsimile {4O5ri}O7i-46h0 
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